CVE-2023-41275 is a medium severity (CVSS 5.5) buffer copy without size check in QNAP QTS, QuTS hero and QuTScloud. An authenticated administrator could use it to execute code over the network. The fix is QTS 5.1.2.2533 build 20230926 or later, or the matching QuTS hero and QuTScloud builds.
What's affected
The NVD record describes the flaw this way: "A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network." QNAP lists the fixed versions in advisory QSA-23-38 as QTS 5.1.2.2533 build 20230926 and later, QuTS hero h5.1.2.2534 build 20230927 and later, and QuTScloud c5.1.5.2651 and later.
The NVD product data names QTS 5.1.0 builds (2348, 2399 and 2418), and the description says "several QNAP operating system versions". Treat QTS, QuTS hero and QuTScloud releases older than the fixed builds as affected until QNAP says otherwise. It is one of seven buffer overflow CVEs in advisory QSA-23-38 (the others are CVE-2023-41273, CVE-2023-41276, CVE-2023-41277, CVE-2023-41278, CVE-2023-41279, CVE-2023-41280). Several records share the same description, so the CWE tags and CVE id are what tell them apart.
QNAP's site blocked our automated request, so this post relies on the record's own text for the version list. Check the advisory for the full table.
The record scores the flaw 5.5 (Medium) with the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:L. It can be reached over the network, the attack complexity is low, it requires high privileges (an administrator account), and it needs no user interaction. The impact on confidentiality is no, on integrity low and on availability low. The scope is marked as changed, meaning the damage can reach beyond the vulnerable component. The weakness classes are CWE-120 (buffer copy without checking size of input) and CWE-122 (heap-based buffer overflow). The record does not mark this CVE as being in the CISA Known Exploited Vulnerabilities catalog, and nothing we read says it is exploited in the wild.
How to check if you're exposed
Sign in to the QTS or QuTS hero admin interface and open the firmware update page to see the installed version and build number. Compare it with the fixed builds above. For QuTScloud, check the version of the cloud instance the same way.
Then check who holds an administrator account on the device. The record says exploitation needs an authenticated administrator, so the number of admin accounts and their password hygiene are the practical measure of exposure.
What to do now
- Update the device to a fixed build: QTS 5.1.2.2533 build 20230926 and later, QuTS hero h5.1.2.2534 build 20230927 and later, and QuTScloud c5.1.5.2651 and later.
- Read QNAP advisory QSA-23-38 for any steps the record does not include.
- Reduce the number of administrator accounts and give each a strong, unique password, with two step verification where available.
- Keep the admin interface off the public internet; reach it through a VPN or an allow list.
Why it matters
These are buffer overflow weaknesses: code copies more data into a memory buffer than it can hold, and the neighbouring bytes get overwritten. That can corrupt memory and, in the worst case, let an attacker run code. The record says the code execution path needs an authenticated administrator.
On a NAS, memory safety bugs in the operating system matter because the device often holds backups and shared files for a whole team. Even a medium score deserves a firmware update on a schedule you control, rather than a long delay.
The record for this CVE does not say which component holds the bug. The weakness tags are CWE-120 and CWE-122.
Quick check
Do I need to be an administrator to trigger this?
The record says the attacker is an authenticated administrator. That lowers the score, but admin accounts are a common target, so still update.
Which builds fix it?
QTS 5.1.2.2533 build 20230926 and later, QuTS hero h5.1.2.2534 build 20230927 and later, and QuTScloud c5.1.5.2651 and later. Confirm in QSA-23-38.
Sources
- QNAP advisory QSA-23-38 (linked from the NVD record; access was blocked when we reviewed it)
- CVE-2023-41275 on Gold
Last reviewed: 19 October 2026.
